ARIA — Privacy Policy

Last updated: 30 July 2026 Effective date: 30 July 2026

This Privacy Policy explains how ARIA (“ARIA”, “the app”, “we”, “us”, “our”) handles your information. ARIA is a personal-finance, calendar, and task assistant for iPhone. It is built around a simple promise: your data lives on your device, and we never sell it.

ARIA is provided by Estuaire Studio, the business name under which Boris Alexander Legkow Orias operates as a sole trader in Quebec, Canada (“the developer”). Boris Alexander Legkow Orias is the enterprise responsible for your personal information under Quebec’s Law 25 (the Act respecting the protection of personal information in the private sector), the federal PIPEDA, and — for users in those regions — the EU/UK GDPR (as data controller) and the California CCPA/CPRA.

• Person in charge of the protection of personal information (Privacy Officer): Boris Alexander Legkow Orias
• Contact: hello@estuaire.studio
• Postal address: 1 rue Boucher, Port-Cartier, QC G5B 2T9, Canada
• Website: https://estuaire.studio

Quebec residents are covered by Law 25; other Canadian users and any personal information that crosses provincial or national borders are covered by PIPEDA. Where more than one law could apply, we apply the higher standard.

Plain-language summary. Almost everything you put into ARIA stays on your iPhone. If you turn on sync, your data is encrypted on your device with a key that stays in your iCloud Keychain — reachable by your own other devices, but never by us — so even we cannot read it. Some features are optional and only run when you switch them on: connecting a bank (Plaid) or importing your calendar (Google/Apple). AI features run on your device — on Apple’s models, or on an optional open-source model you can choose to download. We do not track you across apps or websites, we run no advertising SDKs, and we do not sell your data. This summary is for convenience only; the full text below governs.

1. Who this policy covers

This policy applies to everyone who uses the ARIA iOS app. It covers data you enter, data ARIA reads from services you choose to connect, and the limited data needed to run your account and subscription.

ARIA is intended for a general audience of adults. It is not directed to children, and we do not knowingly collect their data: not from a minor under 14 in Quebec (the age Law 25 keys parental consent to), under 16 in the EU/UK, or under 13 in the United States. See Section 11. (These are the ages at which specific privacy laws require parental consent for data collection — they are narrower than, and don’t change, the Terms of Use’s overall minimum age to use ARIA at all: 16, or 18 where required — see the Terms of Use §2.)

2. The data ARIA handles, and where it lives

ARIA is local-first. Unless a row below says data is “transmitted,” it is stored only on your device (in Apple’s SwiftData store and the iOS Keychain) and is never sent to us or anyone else.

We do not collect: your email address (we never ask Apple for it — see the table above), your bank login credentials (those go directly to Plaid, never to ARIA), your precise location, your contacts, advertising identifiers, or any email content — ARIA never requests Gmail or any other email access.

3. Why we process your data, and our legal bases (GDPR)

Where the GDPR/UK GDPR applies, we rely on the following legal bases (Art. 6):

You can withdraw consent at any time by disconnecting the relevant integration in Settings or turning the feature off. Withdrawing consent does not affect processing that already happened.

Consent, and express consent for sensitive data. We ask for your consent through clear, specific, separate choices — each optional integration (Plaid, Google Calendar) and cloud sync are off until you turn them on. Because your financial information is sensitive, we ask for your express consent before you connect a bank or we process your financial data, and we use it only for the purposes you enabled.

4. On-device intelligence and AI

ARIA’s “intelligence” — the Life Score, proactive nudges, receipt reading, subscription detection, anomaly flags, and the voice assistant — runs on your device using Apple’s on-device Foundation Models, with deterministic on-device logic for scoring and pattern detection.

• Nothing is sent off your device for AI. In this version, every AI request is answered on your device. ARIA does not escalate to Apple Private Cloud Compute (Apple’s privacy-preserving server environment) — that path is not enabled in the shipping app. If a future version enables it, we will say so here first.
• An optional second on-device model. Turning on Settings → ARIA → On-device only pins Apple’s model strictly to your device and downloads a small open-source model (Qwen3-1.7B, 4-bit, Apache-2.0, roughly 1 GB, over Wi-Fi) from the Hugging Face model hub. On iPhones without Apple Intelligence, that downloaded model is what writes ARIA’s phrasing — and, like Apple’s, it runs entirely on your device. The download fetches model weights only: no data about you is sent to Hugging Face or to anyone else. The model is only ever downloaded when you ask for it — either by turning this setting on, or by tapping Download on the PDF statement reader in Finance › Import. Do neither and nothing is downloaded, and ARIA falls back to plain templated wording instead.
• We do not send your data to any third-party AI provider (no OpenAI, no Anthropic, no Google AI). There is no per-token cloud AI in ARIA.
• AI output is informational and may be wrong. ARIA surfaces patterns in your own data; it does not provide financial, investment, tax, or legal advice. See the Terms of Use.
• Automated processing and profiling. ARIA builds insights from a profile of your own data (the Life Score, “safe-to-spend,” anomaly flags, nudges). These are informational and are not decisions made solely by a machine with legal or similarly significant effects — you decide what to do. If we ever introduced such an automated decision, we would tell you, explain the main factors used, let you have the underlying data corrected, and let you ask a person to review it.

5. Third-party services we work with

ARIA uses a small number of providers. We share only what each feature needs, and only when you use that feature. Each provider is an independent controller or processor under its own privacy policy.

Plaid — bank connection (optional)

If you connect a bank, you do so through Plaid Link. You enter your bank credentials directly with Plaid — ARIA never sees or stores them. Plaid returns account and transaction data, which our backend retrieves on your behalf and delivers to your device. The Plaid access token is held server-side only; your device holds only an opaque item identifier. The connection is read-only; ARIA cannot and does not move money, make payments, or initiate transfers. Your use of Plaid is also governed by Plaid’s End User Privacy Policy: https://plaid.com/legal/#end-user-privacy-policy. You can disconnect a bank at any time in Settings, which unlinks the item.

Google — Calendar (optional)

If you connect Google Calendar, ARIA requests read-only access (calendar.readonly) via Google OAuth. OAuth tokens are stored in your device Keychain. ARIA does not request any Gmail access — no email scope is ever requested, and no email content is read.

Limited Use disclosure. ARIA’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically: we access Google Calendar data only to provide and improve the in-app features you request (showing your events); we process this data on your device; we do not transfer it to others except as needed to provide these features, for security, or to comply with law; we do not use it for advertising; and we do not allow humans to read it except with your consent, for security, or as required by law.

Apple — accounts, calendar, purchases, intelligence

ARIA uses Apple frameworks: Sign in with Apple (account creation), EventKit (Apple Calendar), StoreKit (purchases), Speech (on-device transcription), LocalAuthentication (Face ID), ActivityKit (Live Activities), and Foundation Models (on-device intelligence). Apple’s handling of this data is governed by Apple’s Privacy Policy (https://www.apple.com/legal/privacy/).

RevenueCat — subscription management

ARIA+ subscriptions are processed through Apple’s App Store and managed using RevenueCat, which validates your App Store receipt and tells the app whether your subscription is active. RevenueCat receives a pseudonymous app user ID and purchase/receipt data; it does not receive your financial records, calendar, or email. See RevenueCat’s privacy policy: https://www.revenuecat.com/privacy.

Cloudflare — our backend and encrypted sync

Our account, sync, and Plaid backend runs on Cloudflare Workers, a global edge-computing network — our deployment is not pinned to a single country, so requests may be processed at any Cloudflare facility worldwide, including the United States. It stores your end-to-end-encrypted sync backup (which we cannot decrypt), your account record, and — server-side only — your Plaid access token. Cloudflare acts as our hosting processor.

We maintain a current list of sub-processors available on request at hello@estuaire.studio.

6. Analytics and tracking

• ARIA ships no advertising SDKs and performs no cross-app or cross-site tracking. We do not use the Advertising Identifier (IDFA) and do not present an App Tracking Transparency prompt because we do not track you. Our Apple Privacy Manifest declares “Data not used to track you.”
• Usage analytics are opt-in and off by default. If you turn them on in Settings, ARIA records only coarse, non-identifying events (such as which feature was opened) — never your name, email, or any money amount. Turning the setting off erases what was stored. Usage analytics are first-party and stay on your device — there is no third-party analytics provider (the previously-planned PostHog integration was removed). Apple’s MetricKit supplies crash and performance diagnostics on-device, and the App Store may share aggregate, anonymous usage statistics with us through its own App Analytics (only when you have enabled Apple’s Share With App Developers setting on your device). If a future version transmits these diagnostics to our own servers, they will remain free of personal identifiers and we will update this policy first.

7. How we share data

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA). We have not sold or shared personal information in the preceding 12 months.

We disclose data only:

• to the providers in Section 5, strictly to run the features you use;
• if required by law, legal process, or a valid government request;
• to protect the rights, safety, or security of users or the public; or
• in connection with a business transfer (e.g. if the app is acquired), in which case we will notify you and this policy will continue to apply to your data.

8. Data retention

• On-device data stays until you delete it, delete the app, or delete your account.
• Encrypted sync backup is retained while your account is active and deleted when you delete your account (see Section 9).
• Receipt images are never stored — they are processed once and discarded.
• Voice input is ephemeral and discarded after it is used to answer you.
• Optional diagnostics are capped to a small local buffer and cleared when you turn analytics off.
• Account and Plaid records on our backend are deleted when you delete your account, subject to any short retention required for security or legal reasons. One exception is the pseudonymous trial receipt described below.
• Anti-bypass timestamps — a handful of dates in your device’s Keychain (when your 14-day free trial began, when the app last ran, when paid bank sync last ran) — are kept for the life of the device, so that the trial and paid bank-refresh controls can’t be reset by deleting and reinstalling the app. They are dates and nothing else: no name, account, amount, or contact detail, and they never leave your device. For a verified account, our backend also retains one permanent pseudonymous receipt containing only the first trial-start timestamp and record creation timestamp. Its key is derived by one-way hashing your stable account ID; it contains no raw account ID, name, email, financial data, or Plaid token. It is used only to prevent the same verified identity from restarting the trial after account deletion, reinstallation, or a device change. See Section 9.

9. Your rights and choices

In-app controls (available to everyone):

• Export my data — download a complete JSON copy of your records (Settings → Data). Exporting is always available and is never restricted by your subscription.
• Delete account — one action, everywhere. It erases your account and encrypted sync backup on our backend; revokes every linked bank at Plaid and any connected Google Calendar grant; destroys your sync encryption key and your session credential; deletes every record on your device, including any export file ARIA wrote and its working caches; and cancels pending notifications. This cannot be undone. Deleting your account is always available and never restricted by your subscription. Two limited things deliberately survive, and neither contains your ARIA content or financial data:
  • The anti-bypass timestamps — a handful of dates in your device’s Keychain (when your 14-day free trial began, when the app last ran, when paid bank sync last ran). They exist only so that the free trial and paid bank-refresh controls can’t be reset by deleting and reinstalling the app, or by moving the device’s clock back. They contain no name, account, email, or financial data, are marked device-only, and never leave your phone or reach our servers. For a verified account, one separate pseudonymous server receipt also survives: the first trial-start and record-creation timestamps under a SHA-256-derived key. It contains no raw account ID or other account content and exists only to stop delete/recreate, reinstall, and cross-device trial resets.
  • A subscription, if you have one. ARIA+ is billed by Apple, so deleting your ARIA account does not cancel it. Cancel in Settings → your Apple Account → Subscriptions.
• Disconnect integrations — unlink Plaid or Google Calendar at any time.
• Turn off sync / use offline — keep all data on-device only.
• Turn off diagnostics — clears stored events.

EU/UK (GDPR) rights. You may request access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent at any time. Many of these are available directly in-app (export/delete). For anything else, email hello@estuaire.studio. We respond within 30 days (extendable by 60 days for complex requests). You also have the right to lodge a complaint with your supervisory authority. ARIA is offered on the App Store in Canada and the United States and is not marketed or targeted to the EU/UK; where these rights nonetheless apply to you, you can exercise them by writing to the Privacy Officer at the address at the top of this policy.

California (CCPA/CPRA) rights. You may request to know, delete, and correct your personal information, and to limit the use of sensitive personal information. We do not sell or share your personal information and do not discriminate against you for exercising your rights. We acknowledge requests within 10 business days and respond within 45 days (extendable by 45 days). Submit requests at hello@estuaire.studio.

Canada — Quebec (Law 25) & PIPEDA rights. You may:

• access the personal information we hold about you and correct it;
• receive the information you gave us in a structured, commonly used format (we provide JSON) — data portability — or have it sent to another organization you authorize (this covers information you provided, not values ARIA infers, such as the Life Score);
• withdraw your consent at any time, and ask us to stop disseminating or to de-index your information where the law allows;
• be informed about any automated processing, as described in Section 4.

We respond within 30 days. If we refuse a request, we explain why and tell you how to seek a review. You can also complain to a regulator: in Quebec, the Commission d’accès à l’information (CAI) — cai.gouv.qc.ca; elsewhere in Canada, the Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca, 1-800-282-1376. We make this policy publicly available and will provide a copy on request.

We verify requests using reasonable measures proportionate to the data involved. Because we hold no email address for you (see Section 2), the normal proof is control of the Apple Account you signed in with: signing in to ARIA and using the in-app export or delete controls does that by itself. For a request sent by email, we may ask you for details only the account holder would have — and we ask for the least we can, never for a bank credential or a government identifier.

10. Security

• End-to-end encryption. Your sync backup is encrypted on your device with AES-256-GCM using a 256-bit key. That key is stored in your iCloud Keychain, which Apple itself end-to-end encrypts, so it can securely reach your other Apple devices without ever passing through — or being readable by — our servers. We never receive the key and cannot read your synced data.
• In transit, all network traffic uses HTTPS/TLS.
• At rest on device, your session credential is stored device-only in the iOS Keychain (ThisDeviceOnly, not synced anywhere); bank credentials are never handled by ARIA.
• No method of storage or transmission is 100% secure. If a confidentiality incident (data breach) occurs, we assess the risk and respond as the law requires:
  • Quebec (Law 25): where the incident presents a risk of serious injury, we notify the Commission d’accès à l’information and affected individuals with diligence, and we keep a register of incidents.
  • Canada (PIPEDA): where a breach creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify you as soon as feasible.
  • EU/UK (GDPR): we notify the relevant supervisory authority within 72 hours where required, and affected users without undue delay where the risk is high.

11. Children

ARIA is not directed to children. We do not knowingly collect personal information from a minor under 14 in Quebec (where Law 25 keys consent to a parent or tutor), under 16 in the EU/UK, or under 13 in the United States (COPPA). If you believe a child has provided us data, contact hello@estuaire.studio and we will delete it.

12. Communication outside Quebec / Canada, and international transfers

Our backend and service providers (Cloudflare, RevenueCat, Plaid, Google) are US-based companies, and Cloudflare’s network processes data at facilities worldwide (not pinned to a single country) — so some of your information (your account record; if you link a bank, a server-side access token; and your end-to-end-encrypted sync backup) is communicated outside Quebec and Canada.

• For Quebec residents, before relying on a provider outside Quebec we conduct the privacy impact assessment Law 25 requires, and we require our providers to be bound by data-processing terms appropriate to the sensitivity of what they handle (we are formalizing signed agreements with each provider and will update this section once that’s complete); our case in the meantime rests on end-to-end encryption (no host, in the US or elsewhere, can read your synced content) and on data minimization.
• For other Canadian users, we remain accountable under PIPEDA and require our providers to protect your data by contract to a comparable standard.
• For EU/UK users, transfers rely on appropriate safeguards including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

Your synced content is end-to-end encrypted and unreadable in transit and at rest by us and our hosting provider.

13. Changes to this policy

We may update this policy as the app evolves or the law changes. We will post the updated version with a new “Last updated” date and, for material changes, provide in-app notice. Continued use after an update means you accept the revised policy.

14. Contact

Questions, requests, or complaints: Estuaire Studio · hello@estuaire.studio · https://estuaire.studio Boris Alexander Legkow Orias · 1 rue Boucher, Port-Cartier, QC G5B 2T9, Canada

ARIA is an informational tool. It is not a bank, money transmitter, or financial adviser, and it does not move money. See the Terms of Use for details.